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CLASSiriSE  BY:  NSICG  J7€Ji8T80 
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CATE:  12-02-2016 


liPvC:? 
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9 4f^\<tst 
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DECLASSir'/  OtT;  12-31-2040 
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□ Yes  0^0 
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hS 
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(tern:  DATE.:  12-02-2015  fa3 

b7E 


Description: 

(U)  Dell  Poweredge 
Submitted) 

2900,  Gray  Color, 

S/N  G842PC1 

Cotlected  On: 

08/12/2015  04:10  PM 

EST 

Receipt  Item  #: 
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Special  Handling: 

None 

CATS  ID#: 
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Hazardous  lUlaterlais: 
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FBI  Seizure  #: 
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CATS  Abandonment  #: 
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(Only  Paperwork 
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Seizing  Individual: 
Specific: 
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hS 

Others  Agency:  b7C 


Anticipated  Disposition 

None  on  None 


Storage  Information 

Holding  Office:  WASHINGTON  FIELD 
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Last  inventory:  None 
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H CART 
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Case  ID: 

Title  and  Ch^acter  of  Case: 

j ^ =1 

Person  Acquiring  Evidence: 

Date  Acquired: 

Time  Acquired: 

i'l  :;o?/v 

Source  from  which  evidence  acquired: 
[Person's  name/job  title/company/address] 
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Anticipated  Disposition: 

. ...  — : ^ 

Forfeiture  Potential : 

Federal  Taxpayer  Information: 
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□ No 

Q Yes  □ No 
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Estimated  Dollar  Value: 

Total  Drug  Package  Weight: 

Complete  Description  of  Evidence:  (Please  Print) 
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UNITED  STATES  DEPARTMENT  OF  JUSTICE 

FEDERAL  BUREAU  OF  INVESTIGATION 

Receipt  for  Property 
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On  ( date)  ^ ^ item  ( s)  listed  below  were: 
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Special  Handling  Instructions 
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EVIDENCE  CHAIN  OF  CUSTODY 
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□ Req.  C’harging 
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E]  Other 
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□ Freeze 
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□ Valuables 


□ KiJ 
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Initial  Receipt 
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Time  r — 
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Time 
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Signature: 
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Signature: 
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Time 

Signature: 

Printed  Name/ Agency: 
Reason: 


Date  and  Accepted  Custody 
Time 


Signature: 
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Federal  Rules  of  Criminal  Procedure 
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Federal  Taxpayer  Information  (FTI) 
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Title; 
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ITS  ICG 
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Initial  Receipt 

Date  and 
Time 
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Reason;  Initial  Collection 

Co 

Ag 
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Time 
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Signature: 
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Signature: 

Signature: 
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Date  and 
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Signature: 
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Time 
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Time 

Signature: 

Signature: 
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Printed  Name/Ageni^: 
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Time 

Signature: 

Signature: 
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Reason: 

: Reason: 

Relinquished  Custody 
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b3 
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b6 
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(Address) 
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[City  and  State) 

By  .$4 

To  Be  Returned  □ Yes  Q^o 

Receipt  Given  CD  Yes  0^0 

Grand  Jury  Material  - Disseminate  Only  Pursuant  to  Rule  6 (e) 
Federal  Rules  of  Criminal  Procedure 

□ Yes 

Federal  Taxpayer  Information  (FTI) 

□ Yes 


b6 

b7C 


Title: 


iS\ 
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b3 

b7E 


Reference:  

(Communicalion  Enclosing  Material) 


Description : □ Original  notes  re  interview  of 
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J3Eef®El 
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EECLASSIFY  OtJ : 12-31-2040 
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ALL  IHFOF.VATI™  CONT AIMED 
HEREIN  IS  UMC.LASSIEIED  EXCEPT 
StO-n-T  OTHERWISE 


FD-340<Rev,  4-n-03) 

File  Number  


Field  Office  Acquiring  Evidence 

Serial  # of  Originating  Document 
Date  Received  . ¥ !!>/  IWS 

From 


b3 

b7E 


b7E 


b6 

b7C 


0^0 
G/  No 


To  Be  Returned  LI  Yes 

Receipt  Given  Q Yes 
Grand  Jury  Material  - Disseminate  Only  Pursuant  to  Rule  6 (e) 
Federal  Rules  of  Crinunal  Procedure  ^ 

□ Yes 

Federal  Taxpayer  Information  (FTI) 

LI  Yes 


Title: 


1^0 

Lo 

bl 

S) 

b3 

b7E 

Reference: 


(Communication  Enclosing  Material) 


Description: 

□ Original  notes  r 

i ^ \i  (A . 

intf^rvTPwnf 

b7E 

_ ( 

in\\  ^ 

HRC-2417 


ALL  IMFORifATION  CONTAIhJED 


HEKEIH  IS  UtlCLASSIFIiC 

DATE  12-02-2016  BY  J7601STSO  HSICC 


From: 

Sent: 

To: 

Subject: 

Attachmente: 


Monday,  August  24.  2015  1:36  PM 
1fcp>  (FBI) 


jNotice  - Addressing  of  Legal  Demands  .pdf 


hS 

hic 

hS 

b7C 

b7E 


Hello 


- FBI,  Washington  DC, 


[ 


jcannot  preserve  the  data  sought  in  your  legal  process  because  the  request  is  too  voluminous,  (fyou  wish  to 

I Once  submitted]  [will 


send  in  a new  request  limiting  the  number  of  identifiers,  please  fax  it  to 
reconsider  your  legal  process. 


b6 

b7C 

b7E 


Thank  you, 


b7B 
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HRC-2418 


ALL  IHFOR12ATICH  CCtlTAIhlED 


HEREIN  IS  OT-ICLAS3IIIED 

CATS  12-02-201«  BY  j7€^lSTS0  tlSICC 


b7E 


All  legal  demands  must  be  addressed  to  the  proper  corporate  entity  to  be  facially  valid.  For  a) 

services,  for  examplj  [legal  demands  must  be 

addressed  to  th^ 


may  not  be  fulfilled. 


In  the  future  if  your  legal  demand  is  not  property  addressed  it 


b7E 
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ALL  INrOKliAriOlT  COTTAII-ISE 

HEKEIM  IS  Ut'IC  LAS  SHIED 

DATE  12-02-2015  BY  J76J18TS0  ITSICG 


FEDERAL  BUREAU  OF  INVESTIGATION 


FACSIMILE  TRANSMITTAL  SHEET 


IEIUNCLASSIFIED  DCONFIDENTIAL  nSECRET  DTOP  SECRET 


To: 


ATTN:  Custodian  of  Records 


From:  Special  Agend 


Number  of  Pages  Including  Coversheet:5 


Recipient  Fax  Number: 
Recipient  Telephone  # : 

Sender  Telephone  ^ 
Sender  Fax  # I 


b7E 


b6 

b7C 

b7E 


□ URGENT  ^ FOR  REVIEW  Q PLEASE  COMMENT  Q PLEASE  REPLY  Q PLEASE  RECYCLE 


NOTES/COMMENTS: 
Preservation  request 


HRC-2420 


-CONM.  JGURHflL-  DATE  RUG-^20-20 15  *>*=**>*:  TIME  10:  IS 


MODE  = MEMORY  TRANSMI^IOW 


STflRT=fiUG-20  10:15  END=ALEG-20  10:  IS 


FILE  NO.  =474 

STN  NO,  COMM,  RBH?  KO. 


ALL  INFDRld^.TIQN  GQTTTAIl^JED 
HEKEIM  IS  UTJCLASSiriEC 

STATION  NAME/TEL  KO.  PAGES  DUJ^TIGN  CATE  12-02-2015  EY  J7  5J1STS0 


001  OK  a 


005/005  00:00  = 51 


-NSD  hS-4  FROhfl  OFFICE 


i-*  TT  *s 


FEDERAL  BUREAU  OF  INVESTIGATION 


FACSIMILE  TRANSMITTAL  SHEET 


^UNCLASSIFIED  GCONFIDENTIAL  DSECKET  OTOP  SECRET 


Toi 


RECipi^nt  Fax  Number: 


AT7W;  Custodian  of  Records 


Recipient  Telepbcne 


Fram;  Special  Agen| 


Number  of  Pages  Including  Coversheet:5 


Sender  Telephone  M 
Sender  Fax  #j 


□ URGENT  ^ FOR  REVIHW  □ PUASK  COMMENT  □ PLEASE  REPLY  □ PLHAUE;  RiJCYCLE 


NOTES/COMMENTS; 
Preuivation  request 
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b7E 
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DATS:  12-02-2015 

r '' 

ALL  INFORIIATIOH  COtTTAI^^ED 
HEREIN  IS  mC-LASSIFIED  EXCEPT 
l-iHEBE  SHO^N^T  GTHERVilSE 
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File  Number  


HI 
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Serial  « of  Originating  Document 
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D^te  ffpcnvi^d 
From 


b3 

b7E 
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1 (Liiyatiuaiaiej 


By 


To  Be  Returned  □ Yes 

Receipt  Given  D Yes  No 

Grand  Jury  Material  - Disseminate  Only  Pursuant  to  Rule  6 (e) 
Federal  Rules  of  Criminal  Procedure  / 

□ Yes 

Federal  Taxpayer  Information  (FTI) 

D Yes 


b6 

b7C 


Title: 


bl 

b3 

b7E 


Reference: 
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FBI  Preservation  Letter 


This  is  an  automated  response.  Thank  you  for  contacting  

Thej  address  is  exclusively  for  submission  of  criminal  law 

enf^orcement  requests  from  an  agency  in  the  U.S.  If  you  are  not  pursuing  a criminal  case  on 

behalf  of  a law  enforcement  aeencv  in  the  U.S..  please  refer  to  

regarding  how  to  serve  with  legal 

process  and  disregard  the  remainder  if  this  communication . 


When 

pol 

receives  a government  request  for  information  about I 


it  is 


prohibited  by  law.  Prior  to  notifying  the  user,  we  will  take  steps  to  preserve  the 
information  you  requested  and  are  entitled  to  in  accordance  with  the  type  of  legal  process 
submitted . 


I Alternatively, 

we  will  accept  legal  process  served  via  email  to|  | 

Please  do  not  send  duplicate  copies,  as  this  may  increase  the  time  to  process  your  request. 

If  you  have  not  sent  your  request  from  an  official  government-issued  email  address  or  if  you 
are  not  a law  enforcement  agent  submitting  a request  pursuant  to  a criminal  investigation, 
you  may  not  receive  a reply. 
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should  be  faxed  tc  land  are  processed  in  the  order  received  after  consideration 
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Good  Morning 
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soft  copy  of  the  attachment  containing  |to  be  produced  so  that  we  may  ensure 
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any  questions  you  may  have. 
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Re:  Request  for  Preservation  of  Records 


Dean 


Pursuant  to  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a fonnaJ  request  for 
the  preservation  of  all  records  and  other  evidence  in  your  possession  regarding  the| 


pending  fiiither  legal  proc5ess. 


You  are  hereby  requested  to  preserve  the  records  described  below  cunently  in  your 
possession,  including  records  stored  on  backup  media,  in  a form  that  includes  the  complete 
record,  and  records  that  may  come  into  yoxir  possession  from  the  date  of  acknowledgment  of  this 
request  until  receipt  of  a legal  court  order.  You  are  also  requested  not  to  disclose  the  existence 
of  this  request  to  the  subscriber  or  any  other  person,  other  than  as  necessary  to  comply  with  ttiis 
request,  as  the  FBI's  investigation  may  be  jeopardized  by  this  type  of  disclosure.  You  are  also 
requested  not  to  close  the  account  of  the  subscriber,  unless  requested  to  do  so  by  the  subscriber. 
If  conq)Uance  with  this  request  may  result  in  a permanent  or  tenqforary  termination  of  service 
to  the  accounts  described  below,  or  otherwise  alert  the  subscriber  or  user  of  these  accounts  as 
to  your  actions  to  preserve  the  referenced flies  and  records,  please  contact  Special  Agent 

as  soon  as  possible  and  before  taking  any  such  actions. 


This  preservation  request  applies  to  the  following  records  and  evidence: 

A.  All  stored  electronic  communications  and  other  files  reflecting  communications  to 
or  from  the  requested  account. 

B.  All  records  and  other  evidence  relating  to  the  subscribers),  customer(s),  accoimt 
hoIder(s),  Or  other  entity(ies)  associated  with  the  requested  account  including, 
without  lunimtion,  subscriber  names,  user  names,  screen  names  or  other  identities, 
mailing  addresses,  residential  addresses,  business  addresses,  e-mail  addresses  and 
other  contact  information,  telephone  numbers  or  other  subscriber  number  or 
identity,  billing  records,  information  about  the  length  of  service  and  the  types  of 
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services  the  subscriher  or  customer  utilized,  and  any  other  identifying 
information,  whether  such  records  or  other  evidence  are  in  electronic  or  other 
form;  and 

C.  All  connection  logs  and  records  of  user  activity  foe  thd  requested  account, 
including: 

1 . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5.  User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  information  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  during  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  the 
destination  computer,  the  identities  (account  and  screen  names)  and 
subscriber  information,  if  known,  for  any  person  or  entity  to  which  such 
connection  information  relates,  and  all  other  information  related  to  the 
connection  from  ISP  or  its  subsidiaries. 

D.  Any  other  records  and  other  evidence  relating  to  the  requested  account  Such 
records  and  other  evidence  include,  without  limitation,  correspondence  and  other 
records  of  contact  by  any  person  or  entity  about  the  above-referenced  account,  the 
content  and  connection  logs  associated  with  or  relating  to  postings, 
communications  and  any  other  activities  to  or  through  the  requested  account, 
whether  such  records  or  other  evidence  are  in  electronic  or  other  form. 


]who  can  be  reached  at[ 


If  you  have  any  questions  regarding  this  reques  t,  direct  all  inquiries  to 

Special  Agent] 


Sincerely, 


Charles  H.Kable  IV 
Section  Chief 

Counterintelligence  Division 
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- FBI,  Washington  DC , 


has  received  your  preservation  request(s)  on  the  account  naine(s)  listed  in  the  attacljfid 

preserve  the  requested  account  data,  if  any  account  data  exists,  for  a period  of  90  days  from  30  July  2015| 

you  whetlier  any  data  exists  for  the  accounts  that  are  subject  to  your  preservation  request. 
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Be  sure  to  refer  to  this  record  number  when  requesting  the  disclosure 
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18  U.S.C.  2703(f)(2)  of  the  Electronic  Communications  Privacy  Act  permits  a single  90  extension  for  each  preservation  request.  If  we 
do  not  receive  a preservation  extension  request  within  90  days  from  the  date  of  this  preservation  letter,  the  preserved  data  will  be 
destroyed.  Also,  please  be  aware  that  preservations  are  merely  one  time  snapshots  of  the  account  on  the  date  the  information  is 
preserved.  Preservations  are  not  snapshots  made  each  day  during  the  90  day  preservation  timeframe. 

If  you  send  an  extension  to  your  preservation  request,  please  indicate  that  your  request  is  an  extension  so  we  may  quickly  identify  the 
account  that  you  preserved  and  ensure  that  the  initial  data  preservation  is  maintained. 


Finally,  when  you  submit  your  legal  request  for  us  to  disrJn.se  the  preserved  data,  please  provide  the  preservation  request  number 
along  with  the  date  of  the  original  preservation  so  that  may  retrieve  all  relevant  stored  data. 
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Pursuant  tc  Title  18,  United  States  Code  Section  2703(f),  this  letter  is  a fomta]  request  for 


the  preservation  dl  iill  records  and  otiier  evidence  in  your  possession  regarding  the[ 


^nding  further  legal  process. 


You  are  hs  r^by  requested  to  preserve  the  records  described  below  conently  in  your 
possession,  includ:  n g records  stored  on  backup  media,  in  a form  that  includes  the  complete 
record,  and  record: : ihat  may  come  into  your  possession  from  the  date  of  acknowledgment  of  this 
request  until  recei  j < of  a legal  court  order.  You  are  also  requested  not  to  disclose  the  existence 
of  this  request  to  J : *;  subscriber  or  any  other  person,  other  than  as  necessary  to  comply  with  this 
request,  as  the  FB-I ::  investigation  may  be  jeopardized  by  titis  type  of  disclosure.  You  are  also 
requested  not  to  close  the  account  of  the  subscriber,  unless  requested  to  do  so  by  the  subsc^ 

If  compliance  m’j:  i'his  request  may  nsult  in  a permanent  or  tenqforary  termination  of sT 
to  the  accounts  dtxtribed  below,  or  otherwise  alert  tiie  subscriber  or  user  of  these  account 
to  vour  aetbiHS  in  ikif  fUex  and  records,  pleoSC  contact  Special  Age 
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This  preset  >'£ition  request  applies  to  the  following  records  and  evidence: 
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or  £ i>m  the  requested  account 


B.  All  ~::cords  and  other  evidence  relating  to  the  subscribei(s),customer(s),  account 
hol.<  i:r(8),  or  other  entity(ies)  associated  with  the  requested  account  including, 
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Ail  ::onnection  logs  and  records  of  user  activity  for  the  requested  account, 
ins.iding: 

] . Connection  date  and  time; 

2.  Disconnect  date  and  time; 

3.  Method  of  connection  (e.g.,  telnet,  ftp,  http); 

4.  Data  transfer  volume; 

5 . User  name  associated  with  the  connection  and  other  connection 
information,  including  the  Internet  Protocol  address  of  the  source  of  the 
connection; 

6.  Telephone  caller  identification  records;  and 

7.  Connection  infoimation  for  other  computers  to  which  the  user  of  the 
above-referenced  accounts  connected,  by  any  means,  durir^  the 
connection  period,  including  the  destination  IP  address,  connection  time 
and  date,  disconnect  time  and  date,  method  of  connection  to  Ae 
destination  computer,  Ae  identities  (account  and  screen  names)  and 
subscriber  information,  if  hnown,  for  any  person  or  entity  to  which  such 
connection  mformation  relates,  and  all  oAer  information  related  to  Ae 
connection  from  ISP  or  its  sub^Aaries. 
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con:  cut  and  connection  logs  associated  wiA  or  relating  to  postings, 
coir  ] nunications  and  any  other  activities  to  or  through  Ae  requested  account, 
such  records  or  oAer  evidence  are  in  elechonic  or  oAer  form. 


If  you  hftv^  finy  attestjonp  regarding  Ais  request,  please  direct  inquiries  to 
Special  Agen^ ivho  can  be  reached  at 


b6 

b7C 


Sinceretyt 


Charles  ILKable  IV 
Section  Chief 

Counterinteiligence  Division 


HRC-2661 


FEDERAL  BUREAU  OF  INVESTIGATION 
FOI/PA 

DELETED  PAGE  INFORMATION  SHEET 
FOI/PA#  1353814-0 

Total  Deleted  Page(s)  = 14 


Page 

2 - 

Ref erra 

l/Co 

nsu 

It; 

Page 

3 - 

Ref erra 

1/Co 

nsu 

It; 

Page 

4 ^ 

Ref erra 

1/Co 

nsu 

It; 

Page 

5 - 

Ref erra 

1/Co 

nsu 

It; 

Page 

6 

Ref erra 

1/Co 

nsu 

It; 

Page 

7 

Ref erra 

1/Co 

nsu 

It; 

Page 

8 - 

Ref erra 

1/Co 

nsu 

It; 

Page 

9 ^ 

Ref erra 

1/Co 

nsu 

It; 

Page 

10 

Referr 

al/C 

ons 

ul  t ; 

Page 

11 

Referr 

al/C 

ons 

ult ; 

Page 

12 

Referr 

al/C 

ons 

ult ; 

Page 

13 

Referr 

al/C 

ons 

ul  t ; 

Page 

14 

Referr 

al/C 

ons 

ul  t ; 

Page 

15 

Referr 

al/C 

ons 

ult; 

XXXXXXXXXXXXXXXXXXXXXXXX 
X Deleted  Page{s)  X 
X No  Duplication  Fee  X 
X For  this  Page  X 
XXXXXXXXXXXXXXXXXXXXXXXX 


FEDERAL  BUREAU  OF  INVESTIGATION 
FOI/PA 

DELETED  PAGE  INFORMATION  SHEET 
FOI/PA#  1353814-0 


Total 

Page 

Page 

Page 

Page 

Page 

Page 

Page 

Page 

Page 

Page 

Page 

Page 

Page 

Page 


Deleted  Page(s)  = 14 

5 Referral/Consult; 

6 Referral/Consult; 

7 Ref erra  1 /Consul t ; 

8 Ref  erra  1 /Consul  t ; 

9 Referral/Consult; 

10  Referral /Consult ; 

11  Referral /Consult; 

12  Referral /Consult; 

13  Ref  err  al /Consul  t ; 

14  Referral /Consult ; 

15  Referral /Consult ; 

16  Ref  err  al /Consul  t ; 

17  Referral /Consult; 

18  Referral /Consult ; 


xxxxxxxxxxxxxxxxxxxxxxxx 

X Deleted  Page{s)  X 
X No  Duplication  Fee  X 
X For  this  Page  X 
XXXXXXXXXXXXXXXXXXXXXXXX 


WSICG 


CLASSIFIED  BY:  WSICG  JT^JiSISD 
BEASDN:  1 . 4 iC) 

DECLASSIF^f  GIJ:  12-31-2040 
DATE : 12-05-2015 

ALL  It'IFOBliAT  IDI'J  COl^TAIDEC 
HEREIN  IS  mJCLASSiriEE  EXCEPT 
'*^EBE  SRCrvtn  QTHERVIISE 


FD-340(Rev.  4-11-03) 
File  Number  


b3 

b7E 


zM. 


Field  Office  Acquiring  Evidence 
Serial  # of  Originating  Document  ^*1 
Date  Received  ^ ^ 


From 


nronETnTTnTTnr 

itor/interviewee) 

he 

hlC 


(Address) 


(City  and  Stale) 

By  SA 

ToBeRetumed  Cl  Yes 

Receipt  Given  Q Yes  B^o 

Grand  Jury  Material  - Disseminate  Only  Pursuant  to  Rule  6 (e) 
Federal  Rules  of  Crinimal  Procedure 

□ Yes 

Federal  Taxpayer  Information  (FT!) 

□ Yes 


Title: 


he 

hic 


bl 

b3 

bVE 


Reference:  

(Conin^umcaiLDTi  Enclosing  Material ) 


Description: Original  notes  re  interview  of 


he 

hlC 


HRC-2676 


ALL  INi^OR^L2i.TIQlJ  COt'fTAII^EE 

HZRilM  IS  mJChkSSTTlEB 

DATE  12““05“Z0:6  EV  J76J1STS0  I^SICG 


he 

hlC 


/^C‘^  y^fty'iVtjS/Ls-  1^ 

TO  I'^fTL 

C^^£.  ^X^t7%^/t^  i/^UX 

- 


b6 

b7C 


0'^ 


b3 


b3 


Ci^r^  CHa^  fkm^ 


jP 


^S&KiV 

1- 


Gt/*^  ^ 'TO 


aCt>  cu^C/fCiu^ 


b6 

bVC 


b6 

b7C 


A^  pAhuL^  s^HAf^y^C.  &r^fC^ 

- " \A/4if 


— jC£n/i^oA 

C^tti 

vvi-iJiCsifi. 


0^  UhJii 

a 

o jL^tl«L^  'L  ^\aA- 


^8? 


b6 

bVC 


b6 

bVC 


/ 


Ji  $UcJ^  caA»  cp^  i ^jl^o  ^/40  ^7?^ ^ P4^  X > 

J ■ n ir  / \ 


b6 

bVC 


HRC-2677 


- 


/tfCl 


pc  f^\h 


HRC-2678 


CLASSIFIED  BY:  HSICC 
BZA„50H:  1 . 4 (C) 


76JiSTS0 


DECLASSIFY  CIJ  : 12-31-2040 

DATE . 12-05-201^ 


r 


ALL  IHFORi^iATIQN  CONTAIt-lED 
HEREIN  IS  UNCLASSIFIED  E::^:CEPT 
i^EBE  SHOfi^N  DTHERVilSE 


FD-340  (Rev,  4-1 1-03 


File  Number  J 


Field  Office  Acquiring  Evidence 


if 


b3 

bVE 


Serial  U of  Originating  Document 


Date  Received  _r 
From 


3o 


b6 

b7C 


TirrmrorcomnnnTnrT 


Interviewee) 


(Address) 


To  Be  Retuiuetf 


Receipt  Given  d Yes  CEZ  No 

Grand  Jury  Material  - Disseminate  Only  Pursuant  to  Rule  6 (e) 
Federal  Rules  of  Crimiiial  Procedure 

D Ves 

Federal  Taxpayer  Information  (FTl) 

□ Yes 


b6 

b7C 


Title: 


bl 

b3 

b7E 


Reference: 


(Cot^Lmuni cation  Enclosing  Materijl) 


Description; 


Original  notes  re  interview  of 


b6 

b7C 


HRC-2693 


.cf^r  ^ 

CiisplX  ' 

+0  4 

-^ACiC  ^ r / 

0(1?.  0 Sd?- 

"gPc 

_itojciyLCcj_ 

U 

XJQdfl.  iiDOrJ-^\0 

\bu3  • 5~~uooa^ 

■Wfc-^  \iyu.cy^  'x> 

6'^’^  _ (^-(-  - 

:e.u£i2k-.-- — — 


HRC-2695 


FEDERAL  BUREAU  OF  INVESTIGATION 
FOI/PA 

DELETED  PAGE  INFORMATION  SHEET 
FOI/PA#  1353814-0 


Total 

. Deleted  Page(s)  = 

Page 

4 ^ 

b6;  b7C ; b7E; 

Page 

5 - 

b7E; 

Page 

6 - 

b6 ; b7C ; b7  E; 

Page 

7 - 

b7E; 

Page 

8 - 

b7E; 

Page 

9 ^ 

b7E; 

Page 

10 

b6 ; b7C ; b7E; 

Page 

11 

- b7E; 

Page 

12 

b6 ; b7C ; b7E; 

Page 

13 

- b7E; 

Page 

14 

- b7E; 

Page 

15 

- b7E; 

Page 

16 

b6 ; b7C ; b7E; 

Page 

17 

b6 ; b7C;  b7E; 

Page 

18 

- b7E; 

Page 

19 

b6 ; b7C;  b7E; 

Page 

20 

- b7E; 

Page 

21 

- b7E; 

Page 

22 

- b7E; 

Page 

23 

b6 ; b7C;  b7E; 

Page 

24 

b6 ; b7C ; b7E; 

Page 

25 

b6 ; b7C ; b7E; 

Page 

26 

- b7E; 

Page 

27 

- b7E; 

Page 

28 

- b7E; 

Page 

29 

- b7E; 

Page 

30 

b6 ; b7C ; b7E; 

Page 

31 

- b7E; 

Page 

32 

- b7E; 

Page 

33 

- b7E; 

Page 

34 

b6 ; b7C ; b7E; 

Page 

35 

b6 ; b7C;  b7E; 

Page 

36 

- b7E; 

Page 

37 

- b7E; 

Page 

38 

- b7E; 

Page 

39 

b6 ; b7C ; b7E; 

Page 

40 

b6 ; b7C;  b7E; 

Page 

41 

- b7E; 

Page 

42 

- b7E; 

Page 

43 

- b7E; 

Page 

44 

- b7E; 

Page 

45 

b6 ; b7C;  b7E; 

Page 

46 

- b7E; 

Page 

47 

- b7E; 

Page 

48 

- b7E; 

Page 

49 

b6 ; b7C;  b7E; 

Page 

50 

b6 ; b7C;  b7E; 

Page 

51 

- b7E; 

Page  52  b7E; 
Page  53  b7E; 


XXXXXXXXXXXXXXXXXXXXXXXX 
X Deleted  Page{s)  X 
X No  Duplication  Fee  X 
X For  this  Page  X 
XXXXXXXXXXXXXXXXXXXXXXXX 


wsJ 


i-i  I Lr 


1J2.U  jji' : 


LSCa-I;  1.4  iC.) 

ILkSSir:  atv.  12-31-2040 
:E:  12-05-2016 


ALL  INFOFllATIOI'I  COITT AIMED 
/"■^'HEREIN  IS  mrCLASSiriED  EXCEPT 
\ t'iTtEKE  SaCJrtTI  QTMER^ylSE 


FD-340  (Rev.  4-11-031 


File  Number  I 


Field  Office  Acqairing  Evidence 


'■NiPo 


Serial  U of  Originating  Document  . /<^?> 

Date  Received  '<^0  1 <? 


Froni 


Tnanrcwcnfi  tribulor/lnterv  iewee) 


W Fp 


(Address) 


Wai  VifA  jVtrv^ 


(City  and  State) 


By 


To  Be  Returned  Q Yes 

Receipt  Given  O Yes  No 

Grand  Jury  Material  - Disseminate  Only  Pursuant  to  Rule  6 (e) 
Federal  Rules  of  Criminal  Procedure 

□ Yes  E5i?No 

Federal  Taxpayer  Information  (FTI) 

□ Yes  S^o 

Title:  I I 


1 PrHo 


b3 

b7E 


b6 

b7C 


bl 

b3 

b7E 


Reference: 


(Communication  Enclosing  Matcriat^ 


Description:  UJ  Original  notes  re  interview  of 


b6 

b7C 

P b7E 

^ (M 1 ( irrvfjf  m a-I-itvi 

HRC-2698 


ALL  IKFDRliATrOtT  CmTAIbJED 

BE3E11J  IS  ™CLASSIFIED 

DATE  12-05-201?  EV  j7Sji8T80  HSICC 

b6 

b7C 


From: 

Sent: 

To: 

Subject: 


I hS 
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Subject:  Follow  up 

Attachments:  2015.10.05,  Letter  RHJ  to  Datto  Inc  re  Clinton  Server  Backups, PDF 


Agenfl 


Yesterday  evening  we  received  the  attached  letter  from  Chairman  Johnson  of  the  Homeland  Security  & Government 
Affairs  Committee*  We  are  currently  reviewing  the  letter  and  will  formulate  a response.  Obviously^  we  need  to 
disclosure  this  non-confidential  letter  to  both  the  Datto  Board  and  the  investor. 
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I will  telephone  you  to  follow  up* 
Regards, 


Attorney  at  Law  | Attorney  Bio 


'‘^'DAY  PITNEY  LLP 


1100  New  York  Ave.,  NW  Suite  300  | Washinfiton  DC  20005 
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This  message  contains  PRIVILEGED  AND  CONFIDENTIAL  INFORMATION  intended  solely  for  the  use  of  the 
addressee(s)  named  above.  Any  disclosure,  distribution,  copying  or  use  of  the  information  by  others  is  strictly  prohibited.  If 
you  have  received  this  message  in  error,  please  notify  the  sender  by  immediate  reply  and  delete  the  original  message. 
Thank  you. 
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COMMITTEE  ON 

HOMELAND  SECURITY  AND  GOVERNMENTAL  AFFAIRS 


WASHINGTON,  DC  20510-6250 


October  5,  2015 


Mr*  Austin  McChord 
Chief  Executive  Officer 
Datto,  Inc. 

101  Merritt  7,  7th  Floor 
Norwalk,  CT  0685 1 

Dear  Mr.  McChord: 

Tlie  Committee  on  Homeland  Security  and  Governmental  Affairs  is  examining  former 
Secretary  of  Slate  Hillary  Clinton^s  use  of  a private  email  account  and  server  during  her  time  at 
the  State  Department.  The  Committee  has  learned  that  a product  offered  by  Datto,  Inc, — the 
Datto  SIRIS  S2000' — was  purchased  in  2013  for  Secretary  Clinton  to  provide  on-site,  immediate 
recovery  of  backup  data  in  the  event  that  the  primary  server  failed^  The  Committee  is  interested 
in  the  security  and  preservation  of  Secretary  Clinton’s  official  records,  including  whether  this 
backup  device  was  used  to  back  up,  recover,  or  store  those  records  in  any  manner.  I request  your 
assistance  with  this  important  inquiry. 

Datto,  Inc.  is  “an  innovative  provider  of  comprehensive  backup,  recovery  and  business 
continuity  solutions  used  by  thousands  of  managed  service  providers  worldwide,’^  offering  cloud, 
hardware,  and  software  devices.^  A Datto  SIRIS  device,  like  the  one  acquired  for  Secretary 
Clinton,  “takes  data  directly  from  the  server  and  converts  it  into  virtual  machines  that  can  be 
booted  instantly  from  a remote  web  interface/’"^  Essentially,  if  the  primary  server  fails,  the  Datto 
device  acts  as  a virtual  server  to  allow  continued  workflow  while  the  primary  server  is  fixed.^ 
When  acquiring  a Datto  SIRIS  device,  Datto  offers  its  clients  two  options  for  storing  the 
virtualized  backups.  The  first  option  is  to  store  the  backups  on-site  on  the  Datto  SIWS  S2000 
product  itself,  creating  a private  cloud  for  the  data  that  keeps  the  data  within  the  customer’s 
control  only.^  The  second  option  is  the  data  can  be  stored  “remotely  in  Datto’s  secure  cloud.”^ 


“ According  lo  Datto's  website,  its  SIRIS  product  supports  “business  continuity”  with  server  backups,  virtualization, 
and  cloud-based  accessibility.  See  Datto  Siris  2,  found  at  http://www.datto.com/siris. 

“ Platte  River  Networks  Invoice  #1^7942  (May  3 1, 2013)  (on  file  with  the  Comniittee  on  Homeland  Security  and 
Governmental  Affairs). 

^ Datto,  Inc.t  About  Datto,  http://www.datto.com/abouL 
* Dano  SIRIS  Brochure  found  at 

ht  tp : //w  w w,  abl  etek  .c  om/prod  uctcatal  og/datto/s  i ri  s/pdf/DattoS  [ RI S Product  B rochure_r2 . pd  f. 

^ Instant  Virtualization,  Datto  (last  accessed  on  SepL  23,  2015)  h ttp://www. datto, com/tech nologies/instan t- 
virtualization. 

^fd 
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According  to  information  received  by  the  Committee,  Platte  River  Networks  (PRN)* 
billed  the  Clinton  Executive  Service  Corp,  (CESC)  on  May  3 1 , 2013,  to  acquire  a Datto  SIRIS 
S2000  device.  CESC  appears  to  be  a Clinton  family  company.  According  to  documents 
received  by  the  Committee,  CESC  oversaw  contracting  for  the  hardware  and  software  required 
for  Secretary  Clinton's  private  server  and  email.^ 

When  Secretary  Clinton’s  private  server  was  moved  from  her  private  residence  to  the 
New  Jersey-based  data  center,  PRN  set  up  the  Datto  SIRIS  device  at  this  new  location. When 
acquiring  the  Datto  SIRIS  product,  it  appears  that  CESC  representatives  worked  with  PRN 
employees  to  determine  how  the  Datto  device  would  back  up  data  on  Secretary  Clinton's  private 
server.  ^ ^ According  to  documents  received  by  the  Committee,  CESC  chose  to  only  store  the 
backup  data  on-site  on  the  Datto  SIRIS  device,  thus  creating  a private  cloud  managed  by  PRN.'^ 
CESC  specifically  requested  that  no  data  be  stored  on  Datto’s  off-site  cloud  at  any  time.^^ 

Although  Secretary  Clinton  apparently  wanted  *'Datto  options  without  offsite  backup,'’ 
there  was  confusion  among  PRN  employees  when  they  noticed  that  data  from  Secretary 
Clinton’s  private  server  was  potentially  being  sent  to  Datto’s  off-site  backup  location. In 


* Platte  River  Networks  was  hired  by  Secretary  Clinton  in  2013  to  maintain  the  data  stored  on  her  private  server. 

^ Email  from  Infograte  to  Platte  River  Networks  (Apr.  17, 2013)  (on  file  with  the  Committee  on  Homeland  Security 
and  Governmental  Affairs). 

Platte  River  Networks  Invoice  #33427  (June  15, 201 3)  (on  file  with  the  Committee  on  Homeland  Security  and 
Governmental  Affairs). 

See  Email  from  Platte  River  Networks  to  Datto,  Inc.  (June  6, 2013)  (on  file  with  the  Committee  on  Homeland 
Security  and  Governmental  Affairs);  Email  from  Platte  River  Networks  to  Platte  River  Networks  (Jan.  26, 2015); 
Email  from  Platte  River  Networks  to  Platte  River  Networks  (Jan.  26,  2015). 

Email  from  Platte  River  Networks  to  Datto,  Inc.  (June  6,  2013)  (on  file  with  fie  CotTwrtiltec  on  Homeland  Security 
and  Governmental  Affairs).  PRN  billed  for  work  installing  the  device  in  June  Ml  IFor  use  of  the  private  cloud 
capability,  Datto  charges  a monthly  fee.  Each  month  beginning  in  July  2013,  for  "Datto  Month  of 

Private  Cloud  Service.”  This  monthly  service  fee  apparently  allowed  Secretarjl  t>  cbjtttnually  have  a backup 

on  a private,  virtual  cloud  on  the  SIRIS  S2000  device.  See  Platte  River  Netwot^  r^22421  (June  15, 2013); 

Platte  River  Networks  Invoice  #33488  (June  17, 2013);  Platte  River  Networks  ftS  1 307006  (July  1,  2013); 

Platte  River  Networks  Invoice  #18.1308057  (Aug.  5, 2013);  Platte  River  Networks  Invoice  #18.1309050  (Sept  4, 

2013) ;  Platte  River  Networks  Invoice  #18.13 10031  (Oct.  3, 2013);  Platte  River  Networks  Invoice  #18.131 1027 
(Nov,  5,  2013);  Platte  River  Networks  Invoice  #18.1312009  (Dec.  4, 2013);  Platte  River  Networks  Invoice 
#18.1401012  (Jan.  6,  2014);  Platte  River  Networks  Invoice  #18.1402022  (Feb.  3,  2014);  Platte  River  Networks 
Invoice  #18.1403010  (Mar  3, 2014);  Platte  River  Networks  Invoice  #18. 1404011  (Apr.  1, 2014);  Platte  River 
Networks  Invoice  #18.14050 1 1 (May  1,  2014);  Platte  River  Networks  Invoice  #18.140601 1 (June  1, 2014);  Platte 
River  Networks  Invoice  #18.1407012  (July  I,  2014);  Platte  River  Networks  Invoice  #18.1408012  (Aug.  4,  2014); 
Platte  River  Networks  Invoice  #18.1409013  (Sept.  3,  2014);  Platte  River  Networks  Invoice  #18.1410015  (Oct.  I, 

2014) ;  Platte  River  Networks  invoice  #18.141 1016  (Nov.  3,  2014);  Platte  River  Networics  Invoice  #18, 1412015 
(Dec.  2,  2013);  Platte  River  Networks  Invoice  #18.1501015  (Jan.  6, 2015);  Platte  River  Networks  Invoice 

#1B,  1502014  (Feb.  2,  2015);  Platte  River  Networks  Invoice  #18.1503016  (Mar.  3,  2015);  Platte  River  Networks 
Invoice  #18.  [504014  (Apr.  1,2015);  Platte  River  Networks  Invoice  #18.1505016  (May  1,2015);  Platte  River 
Networks  Invoice  #18.1506014  (June  1,  2015);  Platte  River  Networks  Invoice  #18. 1507017  (July  I,  2015);  Platte 
River  Networks  Invoice  #18.1508019  (Aug.  f 2015)  (all  invoices  mentioned  on  file  with  the  Committee  on 
Homeland  Security  and  Governmental  Affairs). 

Email  from  Platte  River  Networks  to  Datto,  Inc.  (June  6,  2013)  (on  file  with  the  Committee  on  Homeland  Security 
and  Governmental  Affairs). 

Email  from  Platte  River  Networks  to  Platte  River  Networks  (Aug.  1, 2013)  (on  file  with  the  Committee  on 
Homeland  Security  and  Governmental  Affairs). 
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August  2015,  employees  at  PRN  discovered  that  Secretary  Clinton’s  private  server  was  syncing 
with  “an  offsite  sync  server , . . belonging  to  Datto.”'^ 

PRN  employees  reached  out  to  Datto  to  determine  if  the  server  was  actually  sending  data 
from  the  private  server  to  Datto’ s off-site  cloud  for  backup.  One  PRN  employee  wrote  to  Datto 
and  stated,  “[w]hen  we  made  the  purchase  [of  the  SIRIS  S2000],  it  was  under  the  understanding 
that  we  didn’t  want  to  backup  to  Datto ’s  [off-site]  datacenter.”'*^  When  a Datto  employee 
determined  that  “for  some  reason  this  device  [the  SIRIS  S2000]  does  appear  to  be  syncing  with 
the  Datto  Cloud,”' ^ another  PRN  employee  bluntly  replied,  “[t]his  is  a problem.  This  data 

should  not  be  stored  in  the  Datto  Cloud Whereas  CESC  specifically  requested  that  no 

data  from  Secretary  Clinton’s  private  server  be  backed  up  off-site,  according  to  this  information, 
it  appears  that  Datto  was  providing  backiqrs  for  the  server  “from  the  beginning”  of  the  contract.'’ 
Thus,  as  of  August  2015,  Datto  apparently  possessed  a backup  of  the  server’s  contents  since  June 
2013. 


In  response  to  this  finding,  PRN  employees  directed  Datto  to  not  delete  the  saved  data 
and  worked  with  Datto  to  find  a way  to  move  the  saved  information  on  Datto ’s  servers  back  to 
Secretary  Clinton’s  private  server.^”  According  to  documents  received  by  the  Committee,  it 
appears  that  Datto  and  PRN  employees  discussed  an  option  to  save  the  data  on  a USB  drive,  send 
the  USB  drive  to  PRN,  and  “then  wipe  [the  data]  from  the  [Datto]  cloud.”^'  Despite  these 
communications,  it  is  unclear  whether  or  not  this  course  of  action  was  followed.  Additionally, 
questions  still  remain  as  to  whether  Datto  actually  transferred  the  data  from  its  off-site  datacenter 
to  the  on-site  server,  what  data  was  backed  up,  and  whether  Datto  wiped  the  data  after  it  was 
transferred. 

It  also  appears  that  PRN  employees  were  directed  by  CESC  to  reduce  how  much  data 
would  be  stored  in  each  backup.  In  August  2015,  a PRN  employee  raised  the  prospect  that  the 
length  of  the  backups  was  reduced  at  sortie  point  during  PRN’s  time  managing  the  server.  In  an 
email  to  a colleague  with  the  subject  line  “CESC  Datto,”  the  PRN  employee  asked  if  it  is 
possible  to  use  Mimecast,^^  PRN’s  email  archiving  system,  to  find  an  old  email  from  CESC 
directing  PRN  to  reduce  the  length  of  Datto ’s  backups.  He  wrote: 


Email  from  Platte  River  Networks  to  Platte  River  Networks  (Aug.  6, 2015)  (on  file  with  the  Committee  on 
Homeland  Security  and  Governmental  Affairs). 

“ Email  from  Platte  River  Networks  to  Datto,  Inc,  (Aug.  6, 2015)  (on  file  with  the  Committee  on  Homeland 
Security  and  Governmental  Affairs). 


Email  from  Platte  River  Networks  to  Platte  River  Networks  (Aug,  7, 2015)  (on  file  with  the  Committee  on 
Homeland  Security  and  Governmental  Affairs). 

“ Email  from  Platte  River  Networks  to  Datto,  Inc.  (Aug.  6, 2015)  (on  file  with  the  Committee  on  Homeland 
Security  and  Governmental  Affairs). 

Email  from  Platte  River  Networks  to  Platte  River  Networks  (Aug.  7, 2015)  (on  file  with  the  Committee  on 
Homeland  Security  and  Governmental  Affairs). 

^ PRN  used  a Mimecast  product  that  allowed  PRN  to  archive  employee  emails  in  a cloud-based  server  and  search 
that  archive  as  needed.  See  Mimecast,  Archiving,  Risk  & Compliance  (last  accessed  on  Sept.  23,  2015) 
https  ://www.  mimecast.  com/solutions/email-archiving-comp]  iance/. 
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Any  chance  you  found  an  old  email  with  their  directive  to  cut  the  backup  back  in 
Oct-Feb.  I know  they  had  you  cut  it  once  in  Oct-Nov,  then  again  to  30days  [sic] 
in  Feb-ish,  If  we  had  that  email,  we  are  golden.  Would  Mimecast  have  archived 
it  by  chance?  Wondering  how  we  can  sneak  an  email  in  now  after  the  fact  asking 
them  when  they  told  us  to  cut  the  backups  and  have  them  confirm  it  for  our 
records.  Starting  to  think  this  whole  thing  really  is  covering  up  some  shaddy 
shit....  I just  think  if  we  have  it  in  writing  that  they  told  us  to  cut  the  backups,  and 
that  we  can  go  public  with  our  statement  saying  we  have  had  backups  since  day 
one,  then  we  were  told  to  trim  to  30days  [sic],  it  would  make  us  look  a WHOLE 
LOT  better.^^ 

The  State  Department  formally  requested  all  of  Secretary  Clinton’s  records  related  to  her 
time  as  Secretary  of  State  on  October  28, 2014.^'^  It  is  unclear  why  Secretary  Clinton’s 
representatives  apparently  directed  PRN  to  reduce  the  backup  time  period  of  her  emails  around 
the  same  time  period  or  in  the  months  following  the  State  Department’s  request. 

In  order  to  better  understand  Datto’s  role  relating  to  Secretary  Clinton’s  private  server, 
the  backup  and  security  capabilities  of  the  private  server,  and  any  directives  provided  to  Datto 
relating  to  the  server,  I ask  that  you  please  provide  the  following  information  and  materials: 

1 . Please  produce  all  documents  and  communications  between  or  among  employees  or 
contractors  of  Datto  and  employees  of  Platte  River  Networks,  Clinton  Executive 
Services  Corp.  (CESC),  or  any  other  party  referring  or  relating  to  Secretary  Clinton’s 
private  server  or  any  backup  device. 

2.  Please  produce  all  contracts  between  Datto  and  Platte  River  Networks,  CESC,  or  any 
other  party  referring  or  relating  to  Secretary  Clinton’s  private  server  or  any  backup 
device, 

3.  Please  produce  all  invoices,  bills,  and  receipts  prepared  by  Datto  or  its  representatives 
or  agents  regarding  Secretary  Clinton’s  private  server  or  any  backup  device. 

4.  Please  produce  all  helpdesk,  service,  or  support  tickets  received  by  Datto  from  Platte 
River  Networks,  CESC,  or  any  other  party  related  to  the  Datto  device  used  to  backup 
Secretary  Clinton’s  private  server, 

5.  Is  Datto  authorized  to  store  classified  information?  Were  any  Datto  employees 
authorized  to  view  classified  information?  Please  explain.  Did  Datto’s  contract 


Email  from  Platte  River  Networks  to  Platte  River  Networks  (Aug.  19, 2015)  (emphasis  added)  (on  file  with  the 
Committee  on  Homeland  Security  and  Governmental  Affairs);  see  also  Email  from  Platte  River  Networks  to  Platte 
River  Networks  (Aug.  1 S,  2015)  (PRN  employee  believes  CESC  direction  to  reduce  the  length  of  time  backups  were 
kept  “was  all  phone  comm[  unication  Is”)  (on  file  with  the  Committee  on  Homeland  Security  and  Governmental 
Affairs). 

Letter  from  Patrick  F.  Kennedy,  Under  Secretary,  U.S.  Department  of  State,  to  Cheryi  Mills  (stamped  Nov.  12, 
2014)  ht^;//www.archives.gov/pres$/press-releases/20 1 5/pdf/attachment4-clinton-letter.pdf. 


HRC-2755 


Mr.  Austin  McChord 
October  5,  201 5 
Pages 


regarding  Secretary  Clinton’s  private  server  include  provisions  related  to  the  storing 
of  classified  information? 

6.  Has  Datto  been  contacted  by  the  Federal  Bureau  of  Investigation  (FBI)  or  any  other 
law-enforcement  entity  regard  Secretary  Clinton’s  private  server?  Has  Datto  turned 
over  any  information,  materials,  or  equipment  to  the  FBI  or  any  other  law 
enforcement  entity?  Please  explain. 

7.  Information  obtained  by  the  Committee  suggests  that  PRN  ordered  a new  Datto 
device  in  201 5 “to  turn  encryption  on  for  the  backups  and  then  to  power  down  the  old 
device.”^^  Please  explain  the  measures  taken  to  ensure  the  security  of  data  stored  on 
the  SIRIS  S2000  device,  the  private  cloud,  and  the  Datto  Cloud. 

a.  Was  the  backup  data  stored  on  the  private  cloud  encrypted  when  the  device 
was  first  installed  in  2013? 

b.  Was  the  backup  data  stored  on  the  Datto  Cloud  encrypted? 

8.  Please  explain  the  process  for  storing  data  in  the  Datto  Cloud. 

a.  How  long  is  data  retained  in  the  cloud? 

b.  What  happens  to  the  data  once  the  required  retention  period  is  reached? 

c.  Is  the  data  deleted  automatically? 

d.  As  mentioned  above,  CESC  requested  that  the  retention  period  for  backups  be 
reduced  to  30  days.  What  information  would  be  lost  by  reducing  the  backup 
retention  period  to  30  days?  Please  explain. 

9.  According  to  documents  received  by  the  Committee,  Datto  was  providing  off-site, 
cloud-based,  back-up  services  for  data  contained  on  Secretary  Clinton’s  private 
server. 

a.  How  much  data  was  stored  on  Datto ’s  cloud?  Please  explain. 

b.  Was  this  data  eventually  moved  elsewhere?  If  so,  where  and  how  was  this 
data  moved?  If  the  data  was  moved  from  Datto ’s  servers,  did  Datto  retain  a 
copy  of  that  data?  If  Datto  retained  a copy,  please  provide  this  material  to  the 
Committee. 

c.  Please  explain  what  security  measures  are  in  place  to  protect  the  data  stored 
on  Datto’ s cloud? 

d.  During  the  time  in  which  Secretary  Clinton’s  private  server  was  backed  up  on 
Datto ’s  cloud,  did  Datto ’s  cloud  come  under  cyberattack?  If  so,  please 
provide  documentation  that  includes  information  about  the  time  and  date  each 
attack  occurred  and  whether  any  data  was  compromised. 

e.  According  to  documents  received  by  the  Committee,  Datto  was  not  supposed 
to  be  storing  data  from  Secretary  Clinton’s  private  server  as  part  of  the 
contract.^^  Please  explain  how  and  why  data  was  stored  on  Datto ’s  cloud. 


” Email  from  Platte  River  Networks  to  Platte  River  Networks  (Aug.  18, 2015)  (on  file  with  the  Committee  on 
Homeland  Security  and  Governmental  Affairs). 

“ Email  from  Channel  Sales  Executive,  Datto,  Inc.,  to  Platte  River  Networks  (Aug.  6, 2015)  (on  file  with  the 
Committee  on  Homeland  Security  and  Governmental  Affairs). 
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f.  As  mentioned  above,  Datto  employees  reviewed  why  backups  to  the  Datto 
cloud  were  occurring.^®  Please  provide  any  documentation  or  correspondence 
related  to  what  these  employees  found. 

Please  provide  this  information  and  materia!  as  soon  as  possible,  but  no  later  than  5:00pm 
on  October  19, 2015.  Additionally,  I ask  that  you  please  provide  the  Committee  with  a staff- 
level  briefing  to  discuss  Dado’s  role  in  baking  up  the  server. 

The  Committee  on  Homeland  Security  and  Governmental  Affairs  is  authorized  by  Rule 
XXV  of  the  Standing  Rules  of  the  Senate  to  investigate  “the  efficiency,  economy,  and 
effectiveness  of  all  agencies  and  departments  of  Government. Additionally,  S.  Res.  73  (1 14th 
Congress)  authorizes  the  Committee  to  examine  “the  efficiency  and  economy  of  operations  of  all 
branches  and  functions  of  the  Government  with  particular  reference  to  (i)  the  effectiveness  of 
present  national  security  methods,  staffing  and  processes.. ..”®°  For  purposes  of  this  request, 
please  refer  to  the  definitions  and  instructions  in  the  enclosure.  To  the  maximiun  extent  possible, 
please  provide  unclassified  responses  to  my  questions;  should  a complete  response  to  any 
question  require  that  you  send  me  classified  information,  you  may  send  me  that  information 
under  separate  cover,  via  the  Office  of  Senate  Security. 

If  you  have  any  questions  about  this  request,  or  concerns  about  the  instructions  or 
requirements  in  the  enclosure,  please  contact  Scott  Wittmann  or  Mike  Lueptow  of  the  Committee 
staff  at  (202)  224-475 1 . Thank  you  for  your  prompt  attention  to  this  marter. 


Sincerely, 


cc:  The  Honorable  Thomas  R.  Carper 

Ranking  Member 

Enclosure 


” Email  from  Channel  Sales  Executive,  Datto,  Inc.,  to  Platte  River  Networks  (Aug.  6, 201 5)  (on  file  with  the 
Committee  on  Homeland  Security  and  Governmental  Affairs). 

^Id. 

S.  Rule  XXV(k);  see  also  S.  Res.  445, 1 08”'  Cong.  (2004). 

S.  Res.  73  § 12,  1 14th  Cong.  (20 15). 
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Ipstructions  for  Responding  a Request 

Committee  on  Homeland  Security  and  Governmental  Affairs 
United  States  Senate 
1 1 4th  Congress 

A.  Responding  to  a Request  for  Documents 

1 . In  complying  with  the  Committee’s  request,  produce  all  responsive  documents  that  are  in 
your  possession,  custody,  or  control,  whether  held  by  you  or  your  past  or  present  agents, 
employees,  and  representatives  acting  on  your  behalf.  You  should  also  produce 
documents  that  you  have  a legal  right  to  obtain,  that  you  have  a right  to  copy  or  to  which 
you  have  access,  as  well  as  documents  that  you  have  placed  in  the  temporary  possession, 
custody,  or  control  of  any  third  party.  Requested  records,  documents,  data,  or 
information  should  not  be  destroyed,  modified,  removed,  transferred,  or  otherwise  made 
inaccessible  to  the  Committee. 

2.  In  the  event  that  any  entity,  organization,  or  person  denoted  in  the  request  has  been  or  is 
also  known  by  any  other  name  or  alias  than  herein  denoted,  the  request  should  be  read 
also  to  include  the  alternative  identification. 

3.  The  Committee’s  preference  is  to  receive  documents  in  electronic  form  (i.e.  CD,  memory 
stick,  or  thumb  drive)  in  lieu  of  paper  productions. 

4.  Documents  produced  in  electronic  form  should  also  be  organized,  identified,  and  indexed 
electronically. 

5.  Electronic  document  productions  should  be  prepared  according  to  the  following 
standards: 

a.  The  production  should  consist  of  single  page  Tagged  Image  Files  (“.tif ’),  files 
accompanied  by  a Concordance-format  load  file,  an  Opticon  reference  file,  and  a 
file  defining  the  fields  and  character  lengths  of  the  load  file. 

b.  Document  numbers  in  the  load  file  should  match  document  Bates  numbers  and  .tif 
file  names. 

c.  If  the  production  is  completed  through  a series  of  multiple  partial  productions, 
field  names  and  file  order  in  all  load  files  should  match. 

d.  All  electronic  documents  produced  should  include  the  following  fields  of 
metadata  specific  to  each  document: 

BEGDOC,  ENDDOC,  TEXT,  BEGATTACH,  ENDATTACH,  PAGECOUNT, 
CUSTODIAN,  RECORDTYPE,  DATE,  TIME,  SENTDATE,  SENTTIME, 
BEGINDATE,  BEGINTIME,  ENDDATE,  ENDTIME,  AUTHOR,  FROM,  CC, 
TO,  BCC,  SUBJECT,  TITLE,  FILENAME,  FILEEXT,  FILESIZE, 
DATECREATED,  TIMECREATED,  DATELASTMOD,  TIMELASTMOD, 
INTMSGID,  INTMSGHEADER,  NATIVELINK,  INTFILPATH,  EXCEPTION, 
BEGATTACH. 
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e.  Alternatively,  if  the  production  cannot  be  made  in  .tif  format,  all  documents 
derived  from  word  processing  programs,  email  applications,  instant  message  logs, 
spreadsheets,  and  wherever  else  practicable  should  be  produced  in  text  searchable 
Portable  Document  Format  (“.pdf’)  format.  Spreadsheets  should  also  be  provided 
in  their  native  form.  Audio  and  video  files  should  be  produced  in  their  native 
format,  although  picture  files  associated  with  email  or  word  processing  programs 
should  be  produced  in  .pdf  format  along  with  the  document  it  is  contained  in  or  to 
which  it  is  attached. 

f.  If  any  of  the  requested  information  is  only  reasonably  available  in  machine- 
readable  form  (such  as  on  a computer  server,  hard  drive,  or  computer  backup 
tape),  consult  with  the  Committee  staff  to  determine  the  appropriate  format  in 
which  to  produce  the  information. 

6.  Documents  produced  to  the  Committee  should  include  an  index  describing  the  contents 
of  the  production.  To  the  extent  more  than  one  CD,  hard  drive,  memory  stick,  thumb 
drive,  box  or  folder  is  produced,  each  CD,  hard  drive,  memory  stick,  thumb  drive,  box  or 
folder  should  contain  an  indeat  describing  its  contents. 

7.  Documents  produced  iti  resp^se  to  the  request  should  be  produced  together  with  copies 
of  file  labels,  dividers  or  identifying  markers  with  which  they  were  associated  when  the 
request  was  served. 

8.  When  producing  documents,  identify  the  paragraph  in  the  Committee’s  schedule  to  which 
the  documents  respond. 

9.  Do  not  refuse  to  produce  documents  on  the  basis  that  any  other  person  or  entity  also 
possesses  non-identical  or  identical  copies  of  the  same  documents. 

10.  This  request  is  continuing  in  nature  and  applies  to  any  newly  discovered  information. 

Any  record,  document,  compilation  of  data  or  information  not  produced  because  it  has 
not  been  located  or  discovered  by  the  return  date,  should  be  produced  immediately  upon 
subsequent  location  or  discovery. 

11.  All  documents  should  be  Bates-stamped  sequentially  and  produced  sequentially.  Each 
page  should  bear  a unique  Bates  number. 

12.  Two  sets  of  documents  should  be  delivered,  one  set  to  the  Majority  Staff  and  one  set  to 
the  Minority  Staff.  When  documents  are  produced  to  the  Committee,  production  sets 
should  be  delivered  to  the  Majority  Staff  in  Room  340  of  the  Dirksen  Senate  Office 
Building  and  the  Minority  Staff  in  Room  346  of  the  Dirksen  Senate  Office  Building, 

13.  If  compliance  with  the  request  cannot  be  made  in  full  by  the  date  specified  in  the  request, 
compliance  should  be  made  to  the  extent  possible  by  that  date.  Notify  Committee  staff  as 
soon  as  possible  if  frill  compliance  cannot  be  made  by  the  date  specified  in  the  request, 
and  provide  an  explanation  for  why  full  compliance  is  not  possible  by  that  date. 
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14.  In  the  event  that  a document  is  withheld  on  the  basis  of  privilege,  provide  a privilege  log 
containing  the  following  information  concerning  any  such  document;  (a)  the  privilege 
asserted;  (b)  the  type  of  document;  (c)  the  general  subject  matter;  (d)  the  date,  author  and 
addressee;  and  (e)  the  relationship  of  the  author  and  addressee  to  each  other. 

15.  If  any  document  responsive  to  this  request  was,  but  no  longer  is,  in  your  possession, 
custody,  or  control,  identify  the  document  (stating  its  date,  author,  subject  and  recipients) 
and  explain  the  circumstances  under  which  the  document  ceased  to  be  in  your  possession, 
custody,  or  cotrtrol. 

16.  If  a datn  Or  Other  descriptive  detail  set  forth  in  this  request  referring  to  a document  is 
inaccurate,  but  the  actual  date  or  other  descriptive  detail  is  known  to  you  or  is  otherwise 
apparent  from  the  context  of  the  request,  produce  all  documents  which  would  be 
responsive  as  if  the  date  or  other  descriptive  detail  were  correct. 

17.  In  the  event  a complete  response  requires  the  production  of  classified  information, 
provide  as  much  information  in  unclassified  form  as  possible  in  your  response  and  send 
all  classified  information  under  separate  cover  via  the  Office  of  Senate  Security. 

18.  Unless  otherwise  specified,  the  period  covered  by  this  request  is  from  January  1,  2009  to 
the  present. 

19.  Upon  completion  of  the  document  production,  you  should  submit  a written  certification, 
signed  by  you  or  your  counsel,  stating  that:  (1)  a diligent  search  has  been  completed  of 
all  documents  in  your  possession,  custody,  or  control  which  reasonably  could  contain 
responsive  documents;  and  (2)  all  documents  located  during  the  search  that  are 
responsive  have  been  produced  to  the  Committee, 

B.  Responding  to  Interrogatories  or  a Request  for  Information 

1 . In  complying  with  the  Committee’s  request,  answer  truthfully  and  completely.  Persons 
that  knowingly  provide  false  testimony  could  be  subject  to  criminal  prosecution  for 
perjury  (when  under  oath)  or  for  making  false  statements.  Persons  that  knowingly 
withhold  subpoenaed  information  could  be  subject  to  proceedings  for  contempt  of 
Congress.  If  you  are  unable  to  answer  an  interrogatory  or  information  request  fully, 
provide  as  much  information  as  possible  and  explain  why  your  answer  is  incomplete. 

2.  In  the  event  that  any  entity,  organization,  or  person  denoted  in  the  request  has  been  or  is 
also  known  by  any  other  name  or  alias  than  herein  denoted,  the  request  should  be  read 
also  to  include  the  alternative  identification. 

3.  Your  response  to  the  Committee’s  interrogatories  or  information  requests  should  be  made 
in  writing  and  should  be  signed  by  you,  your  counsel,  or  a duly  authorized  designee. 
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4.  When  responding  to  interrogatories  or  information  requests,  respond  to  each  paragraph  in 
the  Committee’s  schedule  separately.  Clearly  identify  the  paragraph  in  the  Committee’s 
schedule  to  which  the  information  responds. 

5.  Where  knowledge,  information,  or  facts  are  requested,  the  request  encompasses 
knowledge,  information  or  facts  in  your  possession,  custody,  or  control,  or  in  the 
possession,  custody,  or  control  of  your  staff,  agents,  employees,  representatives,  and  any 
other  person  who  has  possession,  custody,  or  control  of  your  proprietary  knowledge, 
information,  or  facts. 

6.  Do  not  refuse  to  provide  knowledge,  information,  or  facts  on  the  basis  that  any  other 
person  or  entity  also  possesses  the  same  knowledge,  information,  or  facts. 

7.  The  request  is  continuing  in  nature  and  applies  to  any  newly  discovered  knowledge, 
information,  or  facts.  Any  knowledge,  information,  or  facts  not  provided  because  it  was 
not  known  by  the  return  date,  should  be  provided  immediately  upon  subsequent 
discovery. 

8.  Two  sets  of  responses  should  be  delivered,  one  set  to  the  Majority  Staff  and  one  set  to  the 
Minority  Staff.  When  responses  are  provided  to  the  Committee,  copies  should  be 
delivered  to  the  Majority  Staff  in  Room  340  of  the  Dirksen  Senate  Office  Building  and 
the  Minority  Staff  in  Room  346  of  the  Dirksen  Senate  Office  Building. 

9.  If  compliance  with  the  request  cannot  be  made  in  full  by  the  date  specified  in  the  request, 
compliance  should  be  made  to  the  extent  possible  by  that  date.  Notify  Committee  staff  as 
soon  as  possible  if  full  compliance  cannot  be  made  by  the  date  specified  in  the  request, 
and  provide  an  explanation  for  why  full  compliance  is  not  possible  by  that  date. 

10.  In  the  event  that  knowledge,  information,  or  facts  are  withheld  on  the  basis  of  privilege, 
provide  a privilege  log  containing  the  following  information:  (a)  the  privilege  asserted; 
(b)  the  general  subject  matter  of  the  knowledge,  information,  or  facts  withheld;  (c)  the 
source  of  the  knowledge,  information,  or  facts  withheld;  (d)  the  paragraph  in  the 
Committee’s  request  to  which  the  knowledge,  information,  or  facts  are  responsive;  and 
(e)  each  individual  to  whom  the  knowledge,  information,  or  facts  have  been  disclosed. 

1 1 . If  a date  or  other  descriptive  detail  set  forth  in  this  request  is  inaccurate,  but  the  actual 
date  or  other  descriptive  detail  is  known  to  you  or  is  otherwise  apparent  from  the  context 
of  the  request,  provide  the  information  that  would  be  responsive  as  if  the  date  or  other 
descriptive  detail  was  correct. 

12.  In  the  event  a complete  response  requires  the  transmission  of  classified  information, 
provide  as  much  information  in  unclassified  form  as  possible  in  your  response  and  send 
all  classified  information  under  separate  cover  via  the  Office  of  Senate  Security. 

13.  Unless  otherwise  specified,  the  period  covered  by  this  request  is  fi'om  January  1,  2009  to 
the  present. 
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C.  Definitions 

1 . The  term  “document”  in  the  request  or  the  instructions  means  any  written,  recorded,  or 
graphic  matter  of  any  nature  whatsoever,  regardless  of  how  recorded,  and  whether 
original  or  copy,  including,  but  not  limited  to,  the  following:  memoranda,  reports, 
expense  reports,  books,  manuals,  instructions,  financial  reports,  working  papers,  records, 
notes,  letters,  notices,  confirmations,  telegrams,  receipts,  appraisals,  pamphlets, 
magazines,  newspapers,  prospectuses,  inter-office  and  intra-  office  communications, 
electronic  mail  (e-mail),  contracts,  cables,  notations  of  any  type  of  conversation, 
telephone  call,  meeting  or  other  communication,  bulletins,  printed  matter,  computer 
printouts,  teletypes,  invoices,  transcripts,  diaries,  analyses,  returns,  summaries,  minutes, 
bills,  accounts,  estimates,  projections,  comparisons,  messages,  correspondence,  press 
releases,  circulars,  financial  statements,  reviews,  opinions,  offers,  studies  and 
investigations,  questionnaires  and  surveys,  and  work  sheets  (and  all  drafts,  preliminary 
versions,  alterations,  modifications,  revisions,  changes,  and  amendments  of  any  of  the 
foregoing,  as  well  as  any  attachments  or  appendices  thereto),  and  graphic  or  oral  records 
or  representations  of  any  kind  (including  without  limitation,  photographs,  charts,  graphs, 
microfiche,  microfilm,  videotape,  recordings  and  motion  pictures),  and  electronic, 
mechanical,  and  electric  records  or  representations  of  any  kind  (including,  without 
limitation,  tapes,  cassettes,  disks,  and  recordings)  and  other  written,  printed,  typed,  or 
other  graphic  or  recorded  matter  of  any  kind  or  nature,  however  produced  or  reproduced, 
and  whether  preserved  in  writing,  film,  tape,  disk,  videotape  or  otherwise.  A document 
bearing  any  notation  not  a part  of  the  original  text  is  to  be  considered  a separate 
document.  A draft  or  non-identical  copy  is  a separate  document  within  the  meaning  of 
this  term. 

2.  The  term  “communication”  in  the  request  or  the  instructions  means  each  manner  or 
means  of  disclosure  or  exchange  of  information,  regardless  of  means  utilized,  whether 
oral,  electronic,  by  document  or  otherwise,  and  whether  face  to  face,  in  meetings,  by 
telephone,  mail,  telex,  facsimile,  email  (desktop  or  mobile  device),  computer,  text 
message,  instant  message,  MMS  or  SMS  message,  regular  mail,  telexes,  discussions, 
releases,  delivery,  or  otherwise. 

3.  The  terms  “and”  and  “or”  in  the  request  or  the  instructions  should  be  construed  broadly 
and  either  conjunctively  or  disjunctively  to  bring  within  the  scope  of  this  subpoena  any 
information  which  might  otherwise  be  construed  to  be  outside  its  scope.  The  singular 
includes  plural  number,  and  vice  versa.  The  masculine  includes  the  feminine  and  neuter 
genders. 

4.  The  terms  “person”  or  “persons”  in  the  request  or  the  instructions  mean  natural  persons, 
firms,  partnerships,  associations,  corporations,  subsidiaries,  divisions,  departments,  joint 
ventures,  proprietorships,  syndicates,  or  other  legal,  businesses  or  government  entities, 
and  all  subsidiaries,  affiliates,  divisions,  departments,  branches,  or  other  units  thereof. 

5.  The  term  “identify”  in  the  request  or  the  instructions,  when  used  in  a question  about 
individuals,  means  to  provide  the  following  information:  (a)  the  individual’s  complete 
name  and  title;  and  (b)  the  individual’s  business  address  and  phone  number. 
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Instructions  for  Responding  to  a Committee  Request 


6.  The  terms  “referring”  or  “relating”  in  the  request  or  the  instructions,  when  used 
separately  or  collectively,  with  respect  to  any  given  subject,  mean  anything  that 
constitutes,  contains,  embodies,  reflects,  identifies,  states,  refers  to,  deals  with  or  is 
pertinent  to  that  subject  in  any  manner  whatsoever. 

7.  The  term  “employee”  in  the  request  or  the  instructions  means  agent,  borrowed  employee, 
casual  employee,  consultant,  contractor,  de  fact  employee,  independent  contractor,  joint 
adventurer,  loaned  employee,  part-time  employee,  permanent  employee,  provisional 
employee  or  subcontractor. 

8.  The  terms  “you”  and  “your”  in  the  request  or  the  instructions  refer  to  yourself;  your  firm, 
corporation,  partnership,  association,  department,  or  other  legal  or  government  entity, 
including  all  subsidiaries,  divisions,  branches,  or  other  units  thereof;  and  all  members, 
officers,  employees,  agents,  contractors,  and  all  other  individuals  acting  or  purporting  to 
act  on  your  behalf,  including  all  present  and  former  members,  officers,  employees, 
agents,  contractors,  and  all  other  individuals  exercising  or  purporting  to  exercise 
discretion,  make  policy,  and/or  decisions. 

# # # 
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